Runbooks — Maritime & Offshore (Ship/Rig Connectivity Fabric)

1. Onboarding Runbook (New Vessel or Rig Integration)

Objective: Bring a new ship or offshore platform into the SolveForce maritime fabric, ensuring secure crew networks and protected OT systems.

Step Sequence:

  1. Pre-Validation
    • Confirm VSAT service contract (LEO/MEO/GEO constellation).
    • Provision LTE/5G for near-shore ops and microwave at ports.
    • Inventory OT systems (engine control, SCADA, DP systems).
  2. Edge Deployment
    • Install SD-WAN edge with dual VSAT modems (redundant).
    • Configure VLANs/VRFs: OT safety systems, corporate IT, crew welfare Wi-Fi.
    • Deploy edge compute node for OT telemetry buffering.
  3. Zero-Touch Provisioning (ZTP)
    • SD-WAN device registers to controller over VSAT bootstrap.
    • Apply maritime profile (QoS prioritization for OT over crew internet).
  4. Security & Compliance Enrollment
    • Certificates provisioned (PKI/HSM).
    • ZTNA roles: captain, officers, engineers, crew.
    • Logs directed to SIEM tagged under IMO compliance scope.
  5. Functional Tests
    • Validate engine SCADA telemetry loop.
    • Test SATCOM voice call to HQ.
    • Validate crew Wi-Fi segregated from OT.
  6. Handover
    • Vessel registered in CMDB.
    • NOC/SOC thresholds active (latency, jitter, link availability).

2. Failover Runbook (VSAT or Satellite Path Loss)

Objective: Maintain connectivity during satellite failure or link degradation.

Step Sequence:

  1. Detection
    • AIOps detects packet loss >3% or jitter >150 ms on VSAT.
    • Crew reports call/video issues.
  2. Automatic Failover
    • SD-WAN reroutes OT traffic to backup VSAT modem (different satellite beam).
    • Near-shore → LTE/5G automatically prioritized.
    • Port arrival → microwave backhaul engaged.
  3. Validation
    • Synthetic test: SCADA telemetry verified via backup link.
    • Crew VoIP call measured for MOS >3.8.
  4. Notification
    • NOC escalates to SATCOM provider.
    • Captain and IT officer notified.
  5. Recovery
    • Primary beam restored; traffic rebalanced.
    • SLA incident documented.

3. Incident Response Runbook (Crew Wi-Fi Malware → OT Attempt)

Objective: Contain potential cyber threat crossing from crew Wi-Fi into OT systems.

Step Sequence:

  1. Alert
    • SIEM detects lateral movement attempt from crew VLAN to OT VRF.
    • FWaaS flags suspicious port scanning.
  2. Containment
    • SD-WAN policy blocks crew VLAN from OT entirely.
    • Isolate infected crew device.
    • ZTNA session revoked.
  3. Eradication
    • Malware cleaned or device quarantined until port arrival.
    • Crew network re-imaged/reset if required.
  4. Recovery
    • OT network verified clean (no anomalies).
    • Crew Wi-Fi restored with stricter segmentation.
  5. Postmortem
    • SOC report filed under IMO/ISM cyber guidelines.
    • Security rules updated for future voyages.

4. Disaster Recovery Drill Runbook (Rig/Ship Offline Scenario)

Objective: Rehearse full loss of communications and validate DR posture.

Step Sequence:

  1. Scenario Trigger
    • Simulate VSAT antenna failure or catastrophic power loss.
  2. Failover Activation
    • Switch to backup satellite beam or alternate constellation (LEO/MEO).
    • Fallback to HF radio/GMDSS for safety comms if all satellite lost.
    • Crew emergency procedures activated.
  3. Critical Validation
    • Test distress call to MRCC (Maritime Rescue Coordination Center).
    • Validate engine telemetry buffered locally for replay once link restored.
  4. Time-to-Recover Measurement
    • Measure failover timing (<60 sec for dual VSAT).
    • GMDSS call validated within regulatory limits.
  5. Debrief
    • Findings reported to vessel operators and compliance officers.
    • Adjust redundancy (e.g., add LEO constellation subscription).

Roles & Responsibilities

  • NOC: Monitor VSAT, LTE, microwave performance.
  • SOC: Detect crew-to-OT breach attempts, enforce ZTNA.
  • Ship IT Officer: Validate connectivity, isolate compromised devices.
  • Captain/Bridge Crew: Approve emergency DR activation.
  • Vendors/Providers: SATCOM/ISP carrier restoration.

KPIs (Maritime Runbook Metrics)

  • Onboarding: Vessel online <14 days with SATCOM + LTE/5G + microwave tested.
  • Failover: VSAT beam switch <60 sec; MOS ≥3.8 maintained.
  • Breach Containment: <1 hour.
  • DR Drill: GMDSS success = 100%, RTO ≤1 hour for SATCOM restore.
  • Compliance: IMO/ISM audit pass = 100%.

⚖️ Logos Framing

  • Onboarding = writing the vessel’s “name” into the maritime grammar.
  • Failover = synonym substitution across satellite, LTE, microwave.
  • Incident Response = correcting corrupted crew “letters” before they reach the OT script.
  • DR Drills = recursive rehearsal — proving that maritime communication language endures under duress.